potiuk opened a new pull request, #69106:
URL: https://github.com/apache/airflow/pull/69106
### What
`resource_name()` returned the `dag_id` unchanged when it equalled a
reserved resource name. Because a real `dag_id` can be `DAGs` (it passes the
`dag_id` validator), a DAG named `DAGs` resolved to the **global** `DAGs`
permission resource instead of its own per-DAG `DAG:DAGs` resource, so that
DAG's permissions were applied to the wrong resource.
This drops the reserved-name short-circuit so a `dag_id` is always prefixed
(`DAG:<dag_id>`). The already-prefixed branch (`DAG:foo`, `DAG Run:foo`) still
short-circuits — safe because those prefixes contain a colon, which the
`dag_id` validator (`KEY_REGEX = ^[\w.-]+$`) forbids, so no real `dag_id` can
reach it. The same fix is mirrored in the duplicated `airflow-core` copy.
### Tests
- [x] `resource_name("DAGs", RESOURCE_DAG)` now returns `DAG:DAGs` (FAB +
core copies); ordinary and already-prefixed names unchanged
- [x] full `providers/fab` `test_security.py` suite passes; `ruff` clean
##### Was generative AI tooling used to co-author this PR?
- [X] Yes — Claude Opus 4.8
Generated-by: Claude Opus 4.8 following the guidelines at
https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
